阅读:1177回复:1
编程屏蔽USB,大家来看看我的程序,不知道为什么这样。。。。
为了屏蔽U盘,我编了一个简单的FILTER,我理解中FILTER应该都差不多,如果只过滤不对包进行处理的话,下面是我的程序,比较简单。
extern "C" NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject,IN PUNICODE_STRING RegistryString) { NTSTATUS status=STATUS_SUCCESS; DriverObject->DriverExtension->AddDevice=MyFilterAddDevice; DriverObject->DriverUnload=MyFilterUnload; for(int i=0;i<IRP_MJ_MAXIMUM_FUNCTION;i++) DriverObject->MajorFunction=MyFilterDispatch; DriverObject->MajorFunction[IRP_MJ_POWER] = DispatchPower; DriverObject->MajorFunction[IRP_MJ_PNP] = DispatchPnp; return status; } VOID MyFilterUnload(IN PDRIVER_OBJECT DriverObject) { } NTSTATUS MyFilterDispatch(IN PDEVICE_OBJECT fido,IN PIRP Irp) { Irp->IoStatus.Status =STATUS_UNSUCCESSFUL ; Irp->IoStatus.Information = 0; IoCompleteRequest(Irp,IO_NO_INCREMENT); return STATUS_UNSUCCESSFUL; } NTSTATUS MyFilterAddDevice(IN PDRIVER_OBJECT DriverObject,IN PDEVICE_OBJECT pdo) { NTSTATUS status; PDEVICE_OBJECT fido; PDEVICE_OBJECT fdo; PMYFILTER_DEVICE_EXTENSION dx; status=IoCreateDevice(DriverObject,\ sizeof(MYFILTER_DEVICE_EXTENSION),\ NULL,FILE_DEVICE_UNKNOWN,0,FALSE,&fido); if(!NT_SUCCESS(status)) return status; dx=(PMYFILTER_DEVICE_EXTENSION)fido->DeviceExtension; dx->fdo=fido; dx->pdo=pdo; __try{ fdo=IoAttachDeviceToDeviceStack(fido,pdo); dx->pNext=fdo; fido->Flags |= fdo->Flags & (DO_DIRECT_IO|DO_BUFFERED_IO); fido->Flags |= DO_POWER_PAGABLE; fido->DeviceType = fdo->DeviceType; fido->Characteristics = fdo->Characteristics; fido->Flags &= ~DO_DEVICE_INITIALIZING; } __finally { if (!NT_SUCCESS(status)) IoDeleteDevice(fido); } return STATUS_SUCCESS; } NTSTATUS DispatchPnp(PDEVICE_OBJECT fido, PIRP Irp) { PMYFILTER_DEVICE_EXTENSION pdx=(PMYFILTER_DEVICE_EXTENSION)fido->DeviceExtension; PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp); ULONG fcn = stack->MinorFunction; IoSkipCurrentIrpStackLocation(Irp); NTSTATUS status= IoCallDriver(pdx->pNext, Irp); if (fcn == IRP_MN_REMOVE_DEVICE) { IoDetachDevice(pdx->pNext); IoDeleteDevice(fido); } return status; /*return STATUS_UNSUCCESSFUL;*/ } NTSTATUS DispatchPower(PDEVICE_OBJECT fido, PIRP Irp) { PoStartNextPowerIrp(Irp); PMYFILTER_DEVICE_EXTENSION pdx = (PMYFILTER_DEVICE_EXTENSION)fido->DeviceExtension; IoSkipCurrentIrpStackLocation(Irp); NTSTATUS status = PoCallDriver(pdx->pNext, Irp); return status; } 在注册表中{36FC9E60-C465-11CF-8056-444553540000},这个是USB设备的GUID,里建个 UPPERFILTERS值为这个程序的服务,MYFILTER,但没有作用,U盘插上照认,很晕中。。 这个驱动主要是在DISPATHC的处理上,我对任何包,当然我指是读写等都简单地返回STATUS_UNSUCCESSFUL,但这样好像对USB不起作用,不知道为什么。。。。 知道USB设备是靠URB通讯,但不清楚,请各位高手指点。。。 |
|
沙发#
发布于:2004-12-31 16:39
你的USB设备GUID应该是不对滴~~~~~~
这个a5dcbf10, 0x6530, 0x11d2, 0x90, 0x1f, 0x00, 0xc0, 0x4f, 0xb9, 0x51, 0xed 好象才是滴哦~~~~~~~~ |
|